Mac Warner 

Secretary of State 
State of West Virginia 


June 13, 2018 

Brian Newby, Executive Director 
U. S. Election Assistance Commission 
1335 East-West Highway, Suite 4300 
Silver Spring, MD 20910 

Dear Mr. Newby: 

This letter offers a narrative of West Virginia's plan to expend HAVA funds out of the West Virginia 
Secretary of State's (WVSOS) Office. In preparations of this narrative, WVSOS surveyed local election 
officials for cyber and physical security assessments, amended state law to authorize county grants for 
election systems and security upgrades, and repurposed existing state resources to maximize election 
security from the state level. 

On a personal note regarding current and future HAVA funds made available by the federal government, 
I find it important that West Virginia's long-term preparations for cybersecurity protections and 
maintenance of our Statewide Voter Registration System should be funded with a dedicated source 
from our state budget; not short-term federal funds that may not exist in the future. A major concern 
with such short-term federal funds is longevity for providing ongoing and future election systems 
protections, especially as those funds run out. 

With that acknowledgment, I am grateful for this round of additional funding for local election officials 
to bolster local cyber and physical security, and to help purchase new or updated voting systems. In this 
respect the federal government can make a longer-term impact, notwithstanding the fact that systems 
and equipment must be updated and upgraded on a regular basis. 

In short, with election systems being critical infrastructure I am hopeful that this re-authorized release 
of the remaining 2002 HAVA funds is only the beginning of more regular federal funding for 
cybersecurity and equipment upgrades. Without it, our local election officials are left with a huge target 
on their offices, but no armor to protect them. 

Assessment of West Virginia's Security Profile 

Upon taking office as the incoming Secretary of State in January of 2017, WVSOS prioritized review of 
the 2016 election procedures and completed a full assessment of West Virginia's election security. The 
assessment identified many areas for improvement, upon which immediate action was taken to resolve 
previously unaddressed vulnerabilities of West Virginia election security. In 2017, WVSOS immediately 
implemented cybersecurity training programs for local election officials that covered spear phishing, 
password protections, and best practices for using the Statewide Voter Registration System (SVRS). 
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Important West Virginia election security practices include the ability to audit results and mandatory 
public testing of voting equipment by local election officials. Post-election audit procedures are possible 
due to the statutorily required voter verified paper trail (WPT) for all electronic tallying voting 
machines. Thankfully, each of West Virginia's 55 counties are in compliance. As part of every statewide 
election, logic and accuracy tests are run on each machine upon delivery from the vendor. West Virginia 
also requires a post-election hand count audit of 3% of precincts, selected at a random at canvass, to 
ensure accuracy of the voting equipment. If a variance of just 1% is identified, or if the outcome of any 
race changes as a result of the audit, the entire county must be recounted by hand. 

Immediate Action Taken in Preparation of the 2018 Midterm Elections 

West Virginia took immediate preparing for the 2018 midterm elections without any additional HAVA 
funds. To begin, WVSOS enacted a holistic change in security culture that prioritizes all aspects of 
security and encouraged local election officials to do the same. Actions taken by WVSOS and local 
election officials can be summarized into 5 distinct categories: 

1. Advanced Partnership with the West Virginia National Guard 

Coordinating resources between federal, state and local agencies is the number one priority for election 
officials when doing security preparations heading into the 2018 elections. The communication barriers 
across federal agencies to state and local officials proved difficult in 2016 with the lack of information 
sharing platforms and not having sponsorships for clearance to classified information regarding election 
systems. 

In the Fall of 2017, WVSOS entered a partnership with the West Virginia National Guard (WVNG) for a 
full-time Guard member with Top Secret clearance to monitor state-level cyber activity and give 
recommendations on WVSOS security efforts. This advanced partnership is the first instance in the 
country to imbed a National Guard member in the elections arena as a cyber-expert. Through this 
partnership, the WVNG was also able to facilitate vulnerability testing on elections systems prior to the 
2018 midterm primary elections at no additional expense to either agency. The WVNG assets have also 
been successful in designing and managing an appropriate "whitelist" for online access to the state 
election systems. 

2. Participation in Multi-Agencv and Multi-State Information Sharing Platforms 

In 2017, WVSOS partnered with the WV Fusion Center to merge WVSOS cyber resources and the WVSOS 
investigations unit with the state's multi-agency emergency responders to bolster state agencies' 
communications efforts. 

Additionally, WVSOS joined two information sharing networks with the Multi-State Information Sharing 
and Analysis Center (MS-ISAC) and the Election Information Sharing and Analysis Center (EI-ISAC) to 
monitor cyber activity and receive important notifications and best practices from other states to 
increase West Virginia's awareness of the elections landscape on a macro level. 

3. Identify Existing DHS Resources for State and Local Election Officials 

WVSOS has been working diligently to identify all available resources prior to spending funds on election 
security needs. The Department of Homeland Security (DHS) has provided, at no cost to the state, an 
Albert Sensor to allow off site monitoring of state level web traffic of our SVRS and elections systems 






servers. WVSOS and DHS are also in discussions to perform an additional vulnerability scan prior to the 
2018 midterm general elections, as well as discussing a partnership to administer physical security 
assessments for local election officials to be complete by the end of July 2018. 

4. Securing Grant Funding for Local Election Officials for Voting Systems and Security 

During the 2018 Legislative Session, WVSOS worked with the West Virginia Legislature to pass a bill that 
authorizes grant funding opportunities for local election officials for election systems upgrades and 
additional security necessities ahead of the newest round of Federal funding. The West Virginia 
Legislature added the granting opportunity to a previously existing HAVA loan fund for election systems 
totaling around $2,905,628. These funds will be used for improving the administration of elections for 
Federal office by enhancing election technology and security by purchasing election systems, election 
system upgrades, electronic voting systems, or physical security. These grants may be applied for 
beginning in July 2018, and will cover reimbursement for any local election official who intends to 
upgrade voting equipment of security efforts prior to the 2018 General Elections. 

5. Repurposing HAVA 1 Funds for One-Time Security Purchases 

Beginning FY19, WVSOS will repurpose previously existing HAVA funds which had been earmarked for 
SVRS maintenance to be used for one-time expenses such as: 

• Increase cybersecurity protections of the SVRS; 

• Offer additional security training for state and local election officials; 

• Offer the option for local election officials to have "cyber navigators" who conduct in-house 
assessments and offer suggestions for security protections; 

• Implement two-factor authentication for users of the SVRS; 

• Penetration testing of the SVRS and other internet-facing election systems; 

• To create a disaster recovery site; and 

• To continue funding opportunities for ADA-compliant polling locations in 2018 midterms. 

Use of HAVA 2 funds 

West Virginia's long-term security profile will be bolstered leading into the 2018 midterms with the 
repurposing of state funds for maintenance of the SVRS, and the use of existing HAVA 1 funds for one¬ 
time upgrades to security from the State. This will allow West Virginia to use the newly appropriated 
HAVA 2 funds exclusively as grants or loans directly to local election officials to boost their purchasing 
power for elections systems and security. The additional $3,611,943 of HAVA 2 funds will be added to 
the current "County Grant and Loan Fund" that, upon amending the WV HAVA State Plan, will have 
$2,905,628 available to grant, totaling a fund balance of $6,517,571 available for the counties' use. 

Any new funds will be distributed by a HAVA Grant and Loan Board to the counties for election 
equipment (up to 50% grant with a 50% local match), physical security (up to 85% grant with a 15% local 
match), cybersecurity (up to 85% grant with a 15% local match), and e-pollbooks (up to 85% grant with a 
15% local match). Our expectations of the total purchasing power is approximately $10,000,000. 


The Future of West Virginia's Election Security 

The move away from federal funding for maintenance of the SVRS and increasing our funding priorities 
to include election security has put the state-level systems in a position to have a long-term and stable 
funding source for cybersecurity. We fully understand that any cyber system is only as good as the 
weakest link. West Virginia will continue to stay dedicated to increasing our protections, bolster our 
detection capabilities, and stay prepared for corrective action if and when an attack occurs. 

While West Virginia has leveraged every resource possible from existing funds and new funds to the 
County Grant and Loan Fund, we estimate that local election official's efforts will result in only half of all 
registered voters having access to new or upgraded election systems by the 2020 elections. I find the 
most important financial need moving forward is to replace local voting equipment with new, more 
secure equipment. 

West Virginia's economic situation since the first round of HAVA in 2002 has deteriorated and many 
less-populated counties simply do not have resources to prioritize funding election systems over debts 
that continue to rise, such as increasing jail bills and underfunded road maintenance. Even with the 
matching opportunities for voting equipment and cyber upgrades that we will offer, West Virginia is just 
now beginning to recover from the economic storm of recent years. Funds to acquire HAVA mandated 
machines that come with the latest and greatest technology and protections simply do not exist in many 
counties. HAVA 2 funds are greatly appreciated and helpful to local election officials, but I am hopeful 
that our local election officials' needs remain in consideration when Congressional funding discussions 
resume. 


Sincerely, 


Mac Warner 

West Virginia Secretary of State 
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FEDERAL &NON-I 

(Consolidated Budget for total project term -- 
FEDERAL FUNDS (Match) up to 5 years as defined by grantee) 

PROGRAM CATEGORIES 

BUDGET CATEGORIES 

(a) Voting 
Equipment 

(b) Election 
Auditing 

(c ) Voter 
Registration 
Systems 

(d) Cyber Security 

(e) Communications 

HAVA Grant and 

Loan Board 

Distribution 

(g) Other 

TOTALS 

% Fed Total 

1. PERSONNEL (including fringe) 








S 

0% 

2. EQUIPMENT 








$ 

0% 

3. SUBGRANTS- to local voting jurisdictions 






$ 3,611,943.00 


$ 3,611,943.00 

100% 

4. TRAINING 








$ 

0% 

5. All OTHER COSTS 








$ 

0% 

6. TOTAL DIRECT COSTS (1-6) 

$ 

$ 

$ 

$ 

$ 

$ 3,611,943.00 

$ 

$ 3,611,943.00 


7. INDIRECT COSTS (if applied) 








$ 

0% 

8. Total Federal Budget 

$ 

$ 

$ 

$ 

$ 

$ 3,611,943.00 

$ 

$ 3,611,943.00 


11. Non-Federal Match 



$ 769,500.00 





$ 769,500.00 


12. Total Program Budget 

S 

$ 

$ 769,500.00 

$ 

$ 

$ 3,611,943.00 

S 

$ 4.381,443.00 


13. Percentage By Category 

0% 

0% 

0% 

0% 

0% 

100% 

0% 






Proposed State Match 

21.3% 




A. Do you have an Indirect Cost Rate Agreement approved by the Federal government or 
some other non-federal entity? 

If yes, please provide the following information: 

B. Period Covered by the Indirect Cost Rate Agreement (mm/dd/yyyy-mm/dd/yyy): 

No 



C. Approving Federal agency: 

D. If other than Federal agency, please specify: 

E. The Indirect Cost Rate is: 





























































